[SalesForce] Salesforce Certificate Exception: No subject alternative DNS name matching found

We are trying to make a callout to "https://support.dreamwares.com/payment/v1/accounts/somevalue" from Salesforce. But, we are facing an exception:

System.CalloutException: java.security.cert.CertificateException: No subject alternative DNS name matching support.dreamwares.com found.

The domain has a valid SSL certificate.

We have checked from SSL shopper: https://www.sslshopper.com/ssl-checker.html?submit=submit&hostname=support.dreamwares.com

But, still we are facing this issue

We don't understand why is Salesforce not allowing us to make call outs to this domain when it has a valid SSL certificate and the browsers allow it.

We understand that Salesforce only supports the certificates from trusted CA authorities as listed on

https://developer.salesforce.com/page/Outbound_Messaging_SSL_CA_Certificates

Our certificate provider is GoDaddy which is listed in the list in above link. Our our fingerprint matches with godaddyclass2ca

Simple steps to recreate the issue are as follows-

  1. Create a remote site setting for URL – "https://support.dreamwares.com"

  2. Execute the following code from developer console – 

    HttpRequest httpReq = new HttpRequest();
Http httpObj = new Http();
HttpResponse httpResp = new HttpResponse();

httpReq.setEndPoint('https://support.dreamwares.com/payment/accounts/orgid'); 
httpReq.setMethod('GET');

httpResp = httpObj.send(httpReq);

  3. The execution will fail. Check debug logs for details of exception

What is the reason for this issue?

Best Answer

It turns out, as you said, that you can't have multiple certificates on the same IP address. Why every other browser and network service can handle this but Salesforce can't, I have no idea.

We were using a shared hosting provider, and once we got a dedicated IP address and put our sub-domain on that dedicated IP address, it worked.

Now, if only Salesforce would update it's error message to include the fact they don't work with wildcards or multiple certs on one IP address.

stony

Related Topic